Security Filters and Table Permissions

Security Setup in APD controls data access through security filters and table permissions. This provides row-level and operation-level security for portal data access.

Security Setup Overview

The Security Setup page contains two types of entries:

Security Filters - Row-level data restrictions
Table Permissions - AJAX operation permissions

Accessing Security Setup

Open the Advanced Portal Designer menu page (search for it in Tell Me) and click Security Settings (or the equivalent entry that opens the Security Setup list)
View and manage security entries

Security Filter Properties

Field	Description
Profile	Security profile (blank = all)
Security Type	"Security Filter"
Table	Target table number
Field	Target field number
Value	Filter value/expression
Action Code	Specific action (optional)

Security Filter Values

Placeholder Values

Use placeholders for dynamic filtering:

Placeholder	Description	Example
`%1`	User ID	`JOHN.DOE`
`%2`	Company	`CRONUS`
`%3`	Session ID	`abc123...`
`%4`	NAV Identification	`10000` (Customer No.)

Usage Examples

Limit to User's Customer:

Table: Sales Header (36)
Field: Sell-to Customer No. (2)
Value: %4

Limit to User's Company:

Table: Customer (18)
Field: Global Dimension 1 Code (88)
Value: %2

Limit to User's Salesperson:

Table: Sales Header (36)
Field: Salesperson Code (43)
Value: %1

Creating Security Filters

Step-by-Step

Open Security Setup
Click New
Select Security Type: Security Filter
Enter Table number
Enter Field number
Enter Value (with placeholders if needed)
Optionally set Profile and Action Code
Save

Filter Examples

Customer Self-Service:

Profile: CUSTOMER
Security Type: Security Filter
Table: 36 (Sales Header)
Field: 2 (Sell-to Customer No.)
Value: %4

Sales Team by Salesperson:

Profile: SALES
Security Type: Security Filter
Table: 18 (Customer)
Field: 86 (Salesperson Code)
Value: %1

Manager by Department:

Profile: MANAGER
Security Type: Security Filter
Table: 36 (Sales Header)
Field: 80 (Responsibility Center)
Value: SALES

Table Permissions

Permission Properties

Field	Description
Profile	Security profile (blank = all)
Security Type	"Table Permissions"
Table	Target table number
Action Code	Specific action (optional)
Allow Ajax Read	Permit read via AJAX
Allow Ajax Validate/Modify	Permit validate/update via AJAX
Allow Ajax Insert	Permit create via AJAX
Allow Ajax Delete	Permit delete via AJAX
Allow Ajax Lookup	Permit lookup popups
Allow Ajax Insert On Validate	Permit `APD_validate` to create a record if it doesn't exist yet

Creating Table Permissions

Open Security Setup
Click New
Select Security Type: Table Permissions
Enter Table number
Set permission flags as needed
Optionally set Profile and Action Code
Save

Permission Examples

Customer Read-Only:

Profile: CUSTOMER
Security Type: Table Permissions
Table: 36 (Sales Header)
Allow Ajax Read: Yes
Allow Ajax Validate/Modify: No
Allow Ajax Insert: No

Sales CRUD:

Profile: SALES
Security Type: Table Permissions
Table: 36 (Sales Header)
Allow Ajax Read: Yes
Allow Ajax Validate/Modify: Yes
Allow Ajax Insert: Yes

Admin Full Access (per-table — set on every table you want full AJAX access for):

Profile: ADMIN
Security Type: Table Permissions
Table: <table number>
Allow Ajax Read: Yes
Allow Ajax Validate/Modify: Yes
Allow Ajax Insert: Yes
Allow Ajax Delete: Yes

Action-Specific Security

Per-Action Filters

Apply filters only for specific actions:

Profile: CUSTOMER
Security Type: Security Filter
Table: 36 (Sales Header)
Field: 2 (Sell-to Customer No.)
Value: %4
Action Code: ORDERS

This filter only applies when executing the ORDERS action.

Per-Action Permissions

Profile: SALES
Security Type: Table Permissions
Table: 18 (Customer)
Action Code: CUSTOMER-EDIT
Allow Ajax Read: Yes
Allow Ajax Validate/Modify: Yes
Allow Ajax Insert: No

How Filters Apply

Filter Evaluation

User accesses an action
APD collects applicable filters:
- Matching profile or blank profile
- Matching table
- Matching action or blank action
Filters are applied to RecordRef
User sees only matching records

Security filters use Filter Group 6:

Applied automatically
Cannot be overridden by template filters
Always in effect for matching users

Multiple Filters

Cumulative Filters

Multiple filters on the same table are cumulative (AND logic):

Filter 1:
  Table: Customer
  Field: Blocked
  Value: No

Filter 2:
  Table: Customer
  Field: Country/Region Code
  Value: US|CA

Result: Only unblocked customers in US or Canada.

Profile Combinations

When user has multiple profiles:

Filters from all profiles apply
Most restrictive combination used
Permissions combine (OR logic)

Common Patterns

Customer Portal

-- Limit orders to customer --
Profile: CUSTOMER
Table: 36 (Sales Header)
Field: 2 (Sell-to Customer No.)
Value: %4

-- Limit order lines to customer's orders --
Profile: CUSTOMER
Table: 37 (Sales Line)
Field: 2 (Sell-to Customer No.)
Value: %4

-- Limit invoices to customer --
Profile: CUSTOMER
Table: 112 (Sales Invoice Header)
Field: 2 (Sell-to Customer No.)
Value: %4

Vendor Portal

-- Limit purchase orders to vendor --
Profile: VENDOR
Table: 38 (Purchase Header)
Field: 2 (Buy-from Vendor No.)
Value: %4

-- Limit to open orders --
Profile: VENDOR
Table: 38 (Purchase Header)
Field: 120 (Status)
Value: Open|Released

Salesperson Portal

-- Limit customers to salesperson --
Profile: SALES
Table: 18 (Customer)
Field: 86 (Salesperson Code)
Value: %1

-- Limit orders to salesperson's customers --
Profile: SALES
Table: 36 (Sales Header)
Field: 43 (Salesperson Code)
Value: %1

Field-Level Security

APD ships a separate Field Security table (APD Field Security Hgd) for per-field rules — there is no Field Filter value on the Security Setup's Security Type option (the only values are Security Filter and Table Permissions).

A Field Security record specifies:

Field	Description
Security Profile	Profile the rule applies to
Table No.	Table number
Field No.	Field number
Allow Validate	If false, APD will block validate/modify operations on this field for users with this profile

Use Field Security to block validation/modification of a specific field for a given profile. It is not a "hide" mechanism — to suppress display in templates, simply omit the field from the template (or guard it with a <?profile?> block).

Troubleshooting

No Data Showing

Check if filter is too restrictive
Verify placeholder values are correct
Check user's NAV Identification is set
Test filter value manually

Wrong Data Showing

Review all applicable filters
Check for conflicting filters
Verify profile assignments
Check action-specific filters

AJAX Operations Failing

Check table permissions exist
Verify profile matches
Check specific permission flags
Review action code restrictions

Testing Filters

Debug Approach

Create test user with specific profile
Log in as test user
Access relevant action
Verify data visibility
Test AJAX operations

Verify Filter Application

Check that filters are working:

<!-- Display filter info for debugging -->
<?auth?>
    <p>User: <?userid?></p>
    <p>Company: <?company?></p>
    <p>No: <?no?></p>
<?endif?>

Best Practices

Principle of Least Privilege

Start with restrictive filters
Add access as needed
Default to no AJAX permissions

Test Thoroughly

Test each profile combination
Verify data isolation
Check edge cases

Document Filters

Maintain a security matrix:

Profile	Table	Filter	AJAX
CUSTOMER	Sales Header	Own records	Read only
SALES	Customer	Assigned	Full CRUD

Use Action Codes

For complex scenarios, use action-specific filters:

-- Different access by action --
Action: VIEW-ORDER (read only)
Action: EDIT-ORDER (modify allowed)